maggie
Static task
static1
Behavioral task
behavioral1
Sample
8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2.dll
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2.dll
Resource
win10v2004-20240226-en
General
-
Target
8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2
-
Size
187KB
-
MD5
83574d71d86436d2b5829cdf336716f2
-
SHA1
7eb6e7d4e5bd5a34c602879cad0a26b35a3ca4fb
-
SHA256
8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2
-
SHA512
099edefa737728929a0f38c4fea21476b56ee09429b86847a56fb8e9d2dea70a8fae507089604d20458d76c1b8f87f6185832938f8c56faf19de85c1a8450f2f
-
SSDEEP
3072:MQpxdNJneUTb5eOaeXMwurJMLxwldutGRCP+slBQ/8j5uEGY:MQpvNNoCXHIqKlRCP388w+
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2
Files
-
8a5f10ababc234288f68243a3bc7c3349884e5f236a150ae134bb923db60fbd2.dll windows:5 windows x86 arch:x86
babd862289f6ed090c4769001a1f4ead
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
kernel32
GetModuleFileNameA
InterlockedExchange
DuplicateHandle
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
InterlockedIncrement
SetFileAttributesA
InterlockedExchangeAdd
SystemTimeToTzSpecificLocalTime
GetCurrentThread
FindNextFileA
ReadFile
CreateProcessA
CreatePipe
GetEnvironmentVariableA
DeleteFileA
WideCharToMultiByte
GlobalMemoryStatusEx
GetOEMCP
GetACP
GetCPInfo
OutputDebugStringA
Sleep
IsBadReadPtr
GetVersionExA
GetSystemInfo
GetCurrentProcess
LocalFree
GlobalFree
CreateThread
WaitForSingleObject
GetSystemDirectoryA
GetTickCount
WriteFile
SetFilePointer
GetLastError
GetModuleHandleA
InterlockedDecrement
LoadLibraryA
GetProcAddress
FreeLibrary
GetProcessHeap
HeapAlloc
HeapFree
CreateFileA
DeviceIoControl
CloseHandle
GlobalAlloc
FindFirstFileA
FileTimeToSystemTime
FindClose
VirtualQueryEx
VirtualProtectEx
SuspendThread
GetThreadContext
RaiseException
SetLastError
IsValidCodePage
TlsFree
TlsSetValue
TlsAlloc
TlsGetValue
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetCommandLineA
GetCurrentThreadId
MultiByteToWideChar
RtlUnwind
SetThreadContext
FlushInstructionCache
ResumeThread
InterlockedCompareExchange
VirtualProtect
VirtualQuery
LoadLibraryExA
LoadLibraryExW
lstrlenA
SetEndOfFile
WriteConsoleW
GetConsoleOutputCP
WriteConsoleA
FlushFileBuffers
SetStdHandle
SetConsoleCtrlHandler
InitializeCriticalSectionAndSpinCount
HeapCreate
GetLocaleInfoA
GetStringTypeW
GetStringTypeA
HeapSize
GetConsoleMode
GetConsoleCP
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetEnvironmentStrings
FreeEnvironmentStringsA
LCMapStringW
LCMapStringA
GetStartupInfoA
GetFileType
SetHandleCount
GetStdHandle
ExitProcess
HeapReAlloc
VirtualAlloc
VirtualFree
HeapDestroy
user32
PostMessageA
GetSystemMetrics
SetTimer
LoadIconA
LoadCursorA
RegisterClassA
CreateWindowExA
GetMessageA
KillTimer
DefWindowProcA
DispatchMessageA
TranslateMessage
CharLowerBuffA
advapi32
RegCloseKey
RegCreateKeyExA
RegSetValueExA
StartServiceA
ChangeServiceConfigA
OpenSCManagerA
OpenServiceA
CloseServiceHandle
QueryServiceStatus
GetNamedSecurityInfoA
BuildExplicitAccessWithNameA
RegOpenKeyExA
RegQueryValueExA
LookupAccountSidA
GetAclInformation
GetAce
IsValidSid
GetSecurityDescriptorDacl
GetFileSecurityA
AllocateAndInitializeSid
SetEntriesInAclA
SetNamedSecurityInfoA
FreeSid
LookupPrivilegeValueA
AdjustTokenPrivileges
OpenProcessToken
GetTokenInformation
ole32
CoInitializeSecurity
CoInitialize
CoUninitialize
CoSetProxyBlanket
CoCreateInstance
oleaut32
VariantInit
SysFreeString
SysAllocString
VariantClear
odbc32
ord31
ord41
ord11
ord43
ord13
ord36
ord9
ord75
ord24
ord39
opends60
ord26
ord42
ord41
ord25
ord40
ws2_32
gethostname
gethostbyname
WSAIoctl
inet_ntop
WSAGetLastError
getpeername
WSASocketA
WSAEventSelect
ioctlsocket
socket
closesocket
htons
inet_addr
connect
recv
select
__WSAFDIsSet
send
WSASetLastError
WSAStartup
setsockopt
WSACleanup
shutdown
WSASendTo
WSASend
WSAAsyncGetHostByName
WSARecv
WSARecvFrom
WSAAccept
listen
bind
htonl
getsockname
inet_ntoa
WSAAsyncSelect
wininet
HttpQueryInfoA
HttpSendRequestA
HttpOpenRequestA
InternetCloseHandle
InternetReadFile
InternetConnectA
InternetOpenA
InternetCrackUrlA
netapi32
NetApiBufferFree
NetUserEnum
gdi32
GetStockObject
Exports
Exports
Sections
.text Size: 136KB - Virtual size: 135KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 5KB - Virtual size: 22KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourd Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.detourc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ